5.8 HTTP Decryption and Inspection on Cisco FTD, Cisco WSA, and Cisco Umbrella CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard · select all that apply

   A security team is configuring Cisco FTD to inspect decrypted HTTPS traffic. They want to ensure that malware detection and URL filtering are applied. Which of the following must be configured? (Select all that apply.)

   • AEnsure that the decryption policy allows the traffic to be decrypted.
   • BConfigure a separate interface for decrypted traffic.
   • CEnable URL filtering on the decrypted traffic.
   • DEnable the Malware and File policy for decrypted traffic.
   • EDisable decryption for traffic that needs inspection.
   Check answers Discussion Select an answer first
2. 37application · medium

   A company is planning to implement HTTP decryption across their network using Cisco FTD, WSA, and Umbrella. They want to understand the overall architecture. Which statement best describes the roles of these components?

   • AFTD and WSA perform on-premises decryption, while Umbrella provides cloud-based security intelligence.
   • BWSA is used only for URL filtering and does not decrypt.
   • CUmbrella performs decryption and sends traffic to FTD for inspection.
   • DFTD is used only for firewall and cannot decrypt.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An administrator is configuring decryption policies on Cisco WSA. They want to decrypt traffic from the marketing department but bypass decryption for a specific partner portal that uses client certificates. What is the best way to configure this?

   • ACreate a decryption policy that matches the marketing department's source IP and bypasses the partner portal domain.
   • BUse a single policy that decrypts all traffic without exceptions.
   • CDecrypt all traffic and then block the partner portal.
   • DConfigure the partner portal to use HTTP instead of HTTPS.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A school district is implementing SSL decryption on Cisco FTD to protect students. They must comply with child privacy laws (e.g., COPPA) and avoid decrypting traffic to health-related websites. What is the best practice?

   • ACreate a decryption bypass for health-related categories and inform parents/guardians about the monitoring.
   • BBypass decryption for all traffic to avoid legal issues.
   • CDecrypt all traffic to ensure maximum safety.
   • DUse a third-party proxy that does not log traffic.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is deploying SSL decryption on Cisco FTD. They have a limited budget and cannot upgrade hardware. They want to reduce the performance impact of decryption. What is the most cost-effective measure?

   • ADisable all security inspection on decrypted traffic.
   • BUse decryption policies to exclude traffic to high-bandwidth, low-risk destinations like software update servers.
   • CPurchase a dedicated SSL decryption appliance.
   • DIncrease the MTU size to improve throughput.
   Reveal Solution Discussion Select an answer first